I have six of these running in task manager. Two designated at "NETWORK",
three designated as "SYSTEM", and one called "LOCAL". This bothers me as two
of these were at 100% CPU usage, and I could not kill them. Thanks!

"GW" <GW@discussions.microsoft.com> wrote
>I have six of these running in task manager. Two designated at "NETWORK",
> three designated as "SYSTEM", and one called "LOCAL". This bothers me as
> two
> of these were at 100% CPU usage, and I could not kill them. Thanks!

It's normal to have multiple instances of svchost.exe.exe running. It's a
container object for different system services. It's not normal that one
should tie up the system at 100%. It could be windows update.

Download process explorer from Microsoft. This will give you info on the
processes running under each instance of svchost.
http://www.microsoft.com/technet/sys...sExplorer.mspx

Also search the newsgroup for recent posts about svchost 100%. Use Google
Groups Advanced search in microsoft.public.windowsxp.general.

--
Rock [MS-MVP User/Shell]

From Ramesh's web site: http://windowsxp.mvps.org/svchost.htm
Also: http://support.microsoft.com/?kbid=314056

To find out more about Svchost.exe entries try Process Explorer:
http://www.microsoft.com/technet/sys...sExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and 'Show Lower
Pane' options.
(This will provide the detailed info you need)
Next click/Expand the Svchost.exe process that you are interested in.
Then highlight one of the process listed under Svchost, right click and from
the options listed select: google
This should display what out there on the web about that process.

JS

"GW" <GW@discussions.microsoft.com> wrote in message
news:116D2C2D-E5BA-4880-A3E1-66BCF96E8490@microsoft.com...
>I have six of these running in task manager. Two designated at "NETWORK",
> three designated as "SYSTEM", and one called "LOCAL". This bothers me as
> two
> of these were at 100% CPU usage, and I could not kill them. Thanks!

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

GW wrote:
> I have six of these running in task manager. Two designated at "NETWORK",
> three designated as "SYSTEM", and one called "LOCAL". This bothers me as
> two of these were at 100% CPU usage, and I could not kill them. Thanks!

To Rock and JS: I have been having this problem for weeks. At last I find a
racional analysis tool. Thank you very much, Even though I did not pose the
question.

Alvaro

"JS" wrote:

> From Ramesh's web site: http://windowsxp.mvps.org/svchost.htm
> Also: http://support.microsoft.com/?kbid=314056
>
> To find out more about Svchost.exe entries try Process Explorer:
> http://www.microsoft.com/technet/sys...sExplorer.mspx
>
> Once you have Process Explorer installed and running:
> In the taskbar select View and check 'Show Process Tree' and 'Show Lower
> Pane' options.
> (This will provide the detailed info you need)
> Next click/Expand the Svchost.exe process that you are interested in.
> Then highlight one of the process listed under Svchost, right click and from
> the options listed select: google
> This should display what out there on the web about that process.
>
> JS
>
> "GW" <GW@discussions.microsoft.com> wrote in message
> news:116D2C2D-E5BA-4880-A3E1-66BCF96E8490@microsoft.com...
> >I have six of these running in task manager. Two designated at "NETWORK",
> > three designated as "SYSTEM", and one called "LOCAL". This bothers me as
> > two
> > of these were at 100% CPU usage, and I could not kill them. Thanks!
>
>
>

Your Welcome and take note that the most recent version of Process Explorer
no longer use's Google but has switched to MSN's Live Search.

JS

"Computer logon password" <Computerlogonpassword@discussions.microsoft.com >
wrote in message news:1EFEB0BE-0148-4951-B828-B7162987E6E3@microsoft.com...
> To Rock and JS: I have been having this problem for weeks. At last I find
> a
> racional analysis tool. Thank you very much, Even though I did not pose
> the
> question.
>
> Alvaro
>
> "JS" wrote:
>
>> From Ramesh's web site: http://windowsxp.mvps.org/svchost.htm
>> Also: http://support.microsoft.com/?kbid=314056
>>
>> To find out more about Svchost.exe entries try Process Explorer:
>> http://www.microsoft.com/technet/sys...sExplorer.mspx
>>
>> Once you have Process Explorer installed and running:
>> In the taskbar select View and check 'Show Process Tree' and 'Show Lower
>> Pane' options.
>> (This will provide the detailed info you need)
>> Next click/Expand the Svchost.exe process that you are interested in.
>> Then highlight one of the process listed under Svchost, right click and
>> from
>> the options listed select: google
>> This should display what out there on the web about that process.
>>
>> JS
>>
>> "GW" <GW@discussions.microsoft.com> wrote in message
>> news:116D2C2D-E5BA-4880-A3E1-66BCF96E8490@microsoft.com...
>> >I have six of these running in task manager. Two designated at
>> >"NETWORK",
>> > three designated as "SYSTEM", and one called "LOCAL". This bothers me
>> > as
>> > two
>> > of these were at 100% CPU usage, and I could not kill them. Thanks!
>>
>>
>>